<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Specifically .. to audit and update passwords in local vault from 1pw vault for ansible. And then use pass to produce the password when needed. If the env var ANSIBLE_VAULT_PASSWORD_FILE is an executable .. Ansible executes it it takes STDOUT as the password .. so the pw is stored encrypted in pass at rest. Very convenient.<div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div class=""><div class=""><font face="Courier" class="">for env in ${ENVS}; do</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> echo " - checking ${env}"</font></div></div></div><div class=""><div class=""><font face="Courier" class=""><br class=""></font></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> # get password from onepassword</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> op_vault_pw=$( ${OP_EXE} get item ${env}_ansible_vault | jq '.details.password' | tr -d '"' )</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""><br class=""></font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> # test for existence and pull and validate</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> if [[ -d ${PASS_STORE} && \</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> -d ${PASS_STORE}/${env} && \</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> -f ${PASS_STORE}/${env}/ansible_vault_password.gpg ]]; then</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> pass_vault_pw=$( ${PASS_EXE} ${env}/ansible_vault_password )</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> fi</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""><br class=""></font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> # write if needing update</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> if [[ -z "${pass_vault_pw}" || \</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> "${op_vault_pw}" != "${pass_vault_pw}" ]]; then</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> echo " - updating ${env}/ansible_vault_password password from one password"</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> echo -n "${op_vault_pw}" | pass insert -e -f "${env}/ansible_vault_password"</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> fi</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> unset op_vault_pw</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""> unset pass_vault_pw</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""><br class=""></font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class="">done</font></div></div></div></blockquote><div class=""><div class=""><br class=""></div><div class=""><br class=""></div><div class="">ANSIBLE_VAULT_PASSWORD_FILE ...</div><div class=""><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div class=""><div class=""> ><font face="Courier" class=""> cat bin/ansible_vault_password</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class="">#! /bin/sh</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""># use pass to determine password for this env and return it</font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class=""><br class=""></font></div></div></div><div class=""><div class=""><div class=""><font face="Courier" class="">pass ${ENV}/ansible_vault_password</font></div></div></div></blockquote><div class=""><div class=""><br class=""><div class=""><br class="webkit-block-placeholder"></div><div class="">Where i got tripped up is forgot the -e on the 'pass insert' line .. but didnt' get an error. Hope this makes it more clear.</div><div class=""><br class=""></div><div class=""> - b</div><div class="">
<div>branson matheson</div><div><a href="mailto:branson@sandsite.org" class="">branson@sandsite.org</a></div><div class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Feb 5, 2020, at 07:36, <a href="mailto:password-store@storiepvtride.it" class="">password-store@storiepvtride.it</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Am 05.02.20 um 00:00 schrieb branson matheson:<br class=""><blockquote type="cite" class="">Ran into an issue where <br class=""><br class=""> echo "password" | pass insert foo/bar/baz <br class=""></blockquote><br class="">Just out of curiosity, what is your use case for that command instead of:<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>pass generate -i foo/bar/baz<br class=""><br class="">Cheers,<br class="">_______________________________________________<br class="">Password-Store mailing list<br class=""><a href="mailto:Password-Store@lists.zx2c4.com" class="">Password-Store@lists.zx2c4.com</a><br class="">https://lists.zx2c4.com/mailman/listinfo/password-store<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>